Detecting anomalies using real-time controller processing activity

• US 10,649,839 B2
• Filed: 11/08/2019
• Issued: 05/12/2020
• Est. Priority Date: 07/25/2017
• Status: Active Grant

• Current Assignee: Aurora Labs Limited
• Original Assignee: Aurora Labs Limited
• Inventors: Fox, Zohar
• Primary Examiner(s): Duncan, Marc
• Application Number:
  US16/678,003
• Publication Number:
  US 20200073745A1
• Time in Patent Office: 186 Days
• CPC Class Codes: B60W 2050/021 Means for detecting failure or malfunction
• CPC Class Codes: B60W 50/02 Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
• CPC Class Codes: B60W 50/0205 Diagnosing or detecting failures; Failure detection models
• CPC Class Codes: B60W 50/0225 Failure correction strategy
• CPC Class Codes: B60W 50/04 Monitoring the functioning of the control system
• CPC Class Codes: B60W 50/045 Monitoring control system parameters
• CPC Class Codes: G06F 11/0721 within a central processing unit [CPU]
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0793 Remedial or corrective actions recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 11/1629 Error detection by comparing the output of redundant processing systems
• CPC Class Codes: G06F 11/3612 by runtime analysis performance monitoring G06F11/3466
• CPC Class Codes: G06F 12/0284 Multiple user address space allocation, e.g. using different base addresses interprocessor communication G06F15/163
• CPC Class Codes: G06F 12/0646 Configuration or reconfiguration
• CPC Class Codes: G06F 16/188 Virtual file systems
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2212/1008 Correctness of operation, e.g. memory ordering
• CPC Class Codes: G06F 2212/1044 : Space efficiency improvement
• CPC Class Codes: G06F 2212/1056 : Simplification
• CPC Class Codes: G06F 2221/033 : Test or assess software
• CPC Class Codes: G06F 8/60 : Software deployment
• CPC Class Codes: G06F 8/65 : Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 8/654 : using techniques specially adapted for alterable solid state memories, e.g. for EEPROM or flash memories
• CPC Class Codes: G06F 8/656 : while running
• CPC Class Codes: G06F 8/658 : Incremental updates; Differential updates
• CPC Class Codes: G06F 8/66 : of program code stored in read-only memory [ROM]
• CPC Class Codes: G06F 8/71 : Version control security arrangements therefor G06F21/57; Configuration management
• CPC Class Codes: G06F 9/4401 : Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/445 : Program loading or initiating bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57
• CPC Class Codes: G06F 9/44521 : Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading
• CPC Class Codes: G06N 20/00 : Machine learning
• CPC Class Codes: Y02D 10/00 : Energy efficient computing, e.g. low power processors, power management or thermal management

Abstract

Disclosed embodiments relate to identifying Electronic Control Unit (ECU) anomalies in a vehicle. Operations may include monitoring data representing real-time processing activity of the ECU; receiving comparable data relating to processing activity of at least one other ECU deemed comparable in functionality to the ECU; comparing the real-time processing activity data with the comparable data, to identify at least one anomaly in the real-time processing activity of the ECU; and implementing a control action for the ECU when the at least one anomaly is identified.

Claims

1. A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for identifying controller anomalies, comprising:

receiving data representing real-time processing activity of a controller;

receiving comparable data relating to processing activity of at least one other controller deemed comparable in functionality to the controller;

comparing the real-time processing activity data with the comparable data, to identify, based on a deviation between the real-time processing activity data and the comparable data, at least one anomaly in the real-time processing activity of the controller; and

implementing a control action for the controller when the at least one anomaly is identified based on the deviation;

wherein;

the control action includes changing software of a first version on the controller based on a delta file corresponding to a second version of the software on the controller, and

the delta file comprises position-independent code.

2. The non-transitory computer readable medium of claim 1, wherein the comparing comprises implementing a statistical model.

3. The non-transitory computer readable medium of claim 1, wherein the delta file is a multidimensional delta file.

4. The non-transitory computer readable medium of claim 1, wherein the delta file comprises at least one of:

a binary data dimension, a source attribute dimension, and a map file dimension.

5. The non-transitory computer readable medium of claim 1, the operations further comprising determining that the anomaly is detrimental to a system of which the controller is a part, and wherein implementing the control action for the controller is based on the determining.

6. The non-transitory computer readable medium of claim 1, wherein the at least one processor operates according to a multi-tier model, wherein a first tier includes applying a machine learning model or an artificial intelligence algorithm to analyze the data representing real-time processing activity or the comparable data.

7. The non-transitory computer readable medium of claim 6, wherein a second tier operates on an on-demand basis.

8. The non-transitory computer readable medium of claim 7, wherein the second tier involves memory stack analysis.

9. The non-transitory computer readable medium of claim 6, wherein a second tier involves sending a sample of a controller operation to a server.

10. The non-transitory computer readable medium of claim 1, wherein the comparable data comprises a model or map of controller functions.

11. A computer-implemented method for identifying controller anomalies, the method comprising:

receiving data representing real-time processing activity of a controller;

receiving comparable data relating to processing activity of at least one other controller deemed comparable in functionality to the controller;

comparing the real-time processing activity data with the comparable data, to identify, based on a deviation between the real-time processing activity data and the comparable data, at least one anomaly in the real-time processing activity of the controller; and

implementing a control action for the controller when the at least one anomaly is identified based on the deviation;

wherein;

the control action includes changing software of a first version on the controller based on a delta file corresponding to a second version of the software on the controller, and

the delta file comprises position-independent code.

12. The computer-implemented method of claim 11, wherein the comparable data comprises data obtained in real-time relating to processing activity of a plurality of other controllers deemed comparable to the controller.

13. The computer-implemented method of claim 11, wherein the comparable data comprises data previously gathered relating to processing activity of a plurality of other controllers deemed comparable to the controller.

14. The computer-implemented method of claim 11, wherein receiving the comparable data further comprises:

obtaining the comparable data based on rules associated with the software on the controller.

15. The computer-implemented method of claim 11, wherein receiving the comparable data further comprises:

obtaining the comparable data based on known valid sequences of execution of the software on the controller.

16. The computer-implemented method of claim 11, wherein receiving the comparable data further comprises:

obtaining the comparable data based on known malicious sequences of execution of the software on the controller.

17. The computer-implemented method of claim 11, wherein the control action comprises at least one of:

sending an alert associated with the controller;

blocking an instruction sent from the controller;

or

rolling back a version of the software on the controller to a prior version of the software.

18. The computer-implemented method of claim 11, wherein the delta file is a multidimensional delta file comprising at least one of a binary data dimension, a source attribute dimension, and a map file dimension.

19. The computer-implemented method of claim 11, further comprising determining that the anomaly is detrimental to a system of which the controller is a part, and wherein implementing the control action for the controller is based on the determining.

20. The computer-implemented method of claim 11, wherein the comparable data comprises a model or map of controller functions.